Privacy Policy

• You sign in with Google. We store your email + Google ID.
• Your resume is uploaded, converted to LaTeX, and stored on our database. Job descriptions you paste are sent to our LLM provider (DeepSeek) and stored for up to 90 days.
• On the Free tier, a generated PDF is stored for 7 days, then deleted along with the snapshot of the resume content and skill picks behind it - after that the PDF is gone. Paid plans keep your generated PDFs (and can re-download them) for as long as you stay subscribed.
• We don't currently sell personal information about you. We reserve the right to share de-identified, aggregated statistics with third parties (e.g., "X% of our users tailor for engineering roles") and to use your content to improve our service, but not to train external AI models without your explicit consent.
• You can delete your account and everything tied to it at any time from /account -> Danger zone.

Jiablo ("we", "us") is a sole proprietorship operated from California, USA, providing the AI resume-tailoring service available at jiablo.com. For any privacy-related question or request, contact privacy@jiablo.com.

Account information (when you sign in with Google): your email address, Google account ID, name and profile image (if Google returns them).

Resume content (when you upload): the PDF file you provide and the LaTeX representation we extract from it. The PDF bytes are processed in memory during extraction and not retained; the LaTeX text is stored on our database for your future tailoring runs.

Job description content (when you tailor): the JD text you paste, plus the company and role we extract from it.

Tailor outputs: each tailor run is logged with status, timestamps, a snapshot of the resume content used for that run, the categorized skills you picked, and the compiled PDF.

Billing details (when you subscribe): handled by Stripe. We never see your card number. We store the Stripe customer ID and subscription state to match payments to your account.

Operational metadata: rate-limit events (per-user request counts in rolling windows), LLM spend ledger (cost per call), and IP addresses captured by our hosting provider for security and abuse detection.

Referral attribution (if you arrive via a ?ref=CODE link): the code is stored in a cookie for 30 days; on signup it's recorded against your account.

We do not collect: advertising trackers, third-party analytics cookies, location data, contacts, microphone/camera, or anything not listed above.

We use your data to deliver, operate, secure, and improve the Service:

• Your stored resume LaTeX is read on every tailor run.
• Job description text is sent to our LLM provider to extract company/role/skills and to categorize matches against your existing Skills sections.
• Generated PDFs are stored so you can re-download them within the retention window.
• Email is used for account recovery, billing receipts, and (rarely) operational notices about the Service. We don't send marketing email unless you separately opt in.
• Aggregated, de-identified metrics (totals, distributions, conversion rates) are used for product analytics. These do not identify you individually.

What we don't do: we do not currently sell personal information that identifies you. We do not use your resume or job descriptions to train external AI models. We do not share data with advertisers.

If we ever change any of these "don't"s, we'll update this policy, notify account holders by email, and where required by law, provide an opt-out mechanism before the change takes effect.

• Generated PDFs: on the Free tier, 7 days after creation, then nulled by a daily retention job. On paid plans (Search, Need a Job Now) they are kept while the subscription is active.
• Job description text: 90 days, then redacted from the run row.
• Run history: the status/timestamp metadata is kept indefinitely while your account is active so the "Past tailors" list works. Each run also captures a snapshot of the resume content used and the skills you picked: on paid plans this is kept while you stay subscribed (it lets us re-download or rebuild the exact PDF); on the Free tier it is deleted with the PDF at 7 days. All of it is removed when you delete your account.
• Exit-survey feedback: kept until you delete your account.
• Rate-limit event rows: 24 hours, then purged.
• LLM spend ledger rows: 30 days.
• Resume LaTeX: until you re-upload or delete your account.
• Account row: until you delete your account via the Danger zone on your account page.
• Billing records held by Stripe: per Stripe's retention policy (typically 7+ years for tax compliance, outside our control).
• Aggregated/anonymized statistics: indefinite; not tied to your identity after aggregation.

We share data only with the service providers we use to run the product. We don't share data with advertisers, brokers, or any third party for marketing purposes.

Our infrastructure is primarily in the United States. To deliver the LLM-powered features, we transfer job description text and the relevant portions of your resume to DeepSeek, which operates in China. China is not currently subject to an EU/UK adequacy decision; this transfer is a material disclosure for users outside the US.

When you create an account you agree to our Terms and this Privacy Policy, which includes your understanding of and consent to this transfer; by continuing to use the Service you reaffirm that consent. If you are uncomfortable with your data being sent outside your country of residence, please do not use the Service.

If you have specific compliance requirements (e.g., your employer or government prohibits transfers to certain countries), you should not use the Service with content subject to those restrictions.

Regardless of where you live, you can:

• View and edit your resume LaTeX at any time from your account page.
• Cancel your subscription at any time via Stripe's customer portal.
• Permanently delete your account and all linked data via your account page (Danger zone -> Delete account). This cascades to your resume, run history, PDFs, rate-limit records, and active subscription cancellation.
• Email privacy@jiablo.com for help with any of the above.

If you are in the EU, UK, EEA, or Switzerland (GDPR / UK-GDPR): you also have the right to access a copy of the personal data we hold about you, correct inaccuracies, object to processing, restrict processing, request data portability, and lodge a complaint with your local supervisory authority. Email privacy@jiablo.com to exercise these rights; we'll respond within 30 days.

If you are a California resident (CCPA / CPRA): you have the right to know what categories of personal information we collect, request a copy, request deletion, correct inaccuracies, and opt out of any "sale" or "sharing" (as those terms are defined under California law). We don't currently sell or share personal information in those defined senses. If that changes, we will provide a "Do Not Sell or Share My Personal Information" link as required.

If you live elsewhere (Virginia, Colorado, Connecticut, Utah, Texas, Florida, etc.) and your jurisdiction grants you similar rights: same email, same 30-day window.

We use only the following cookies, all set on our own domain:

• Session cookie (set by Better Auth on sign-in): httpOnly, SameSite=Lax, expires after 30 days of inactivity. Required for the Service to work.
• Referral cookie (jiablo_ref): set if you arrive via a ?ref=CODE link. httpOnly, 30-day TTL, cleared once attribution is recorded.

We do not use advertising or third-party tracking cookies. We do not have a Google Analytics, Facebook Pixel, or any similar tracker.

We use TLS for all traffic, bearer-token authentication on internal services (compile worker), and httpOnly + SameSite=Lax session cookies. Authentication is delegated to Google OAuth; we never see or store your Google password. Billing is delegated to Stripe with signed webhook validation.

No system is perfectly secure. If you find a security issue, please email security@jiablo.com before disclosing publicly.

Jiablo is not directed at children under 13. We don't knowingly collect data from anyone under 13. If you believe a minor has signed up, email us and we'll delete the account.

If we materially change what we collect, how we use it, who we share it with, or your rights under this policy, we'll update this page and email account holders before the change takes effect.

Privacy questions and rights requests: privacy@jiablo.com

Account / billing support: support@jiablo.com

Security disclosure: security@jiablo.com